I-ProtectHome ngokumelene nembewu ye-TOTP: kungani ukungena kwe-VPN kuhluleka

Uhlelo lokuqinisekisa lubonisa ikhodi entsha enamadijithi ayisithupha, i-VPN iyayenqaba, futhi leyo khodi iqinisekiswa kahle uma uyihlola kusuka ku-shell yakho. Lelo gebe yindaba yonke. I-PAM module engakwazi ukuvula imfihlo yokubhalisa ibuyisela ukwehluleka okubonakala kufana nekhodi engalungile, futhi indawo yesevisi efihla izikhombisi zasekhaya iyisizathu esivamile. Ngaphambi kokuxegisa noma yiluphi ilungelo, nquma ukuthi usesimweni sini kwezintathu.

Ikuphi kwezi zingaphumeleli ezintathu?

Eyokuqala imfihlo i-module engakwazi ukuyifunda nhlobo. Eyesibili imfihlo engayifunda kodwa engakwazi ukuyibuyekeza. Eyesithathu ikhodi engalungile ngempela, ngokuvamile ngenxa yokuhlehla kwewashi noma inani elisetshenziswe kabusha.

Zihlukanise ngokufunda ijenele lesevisi kanye nelogi yokuqinisekisa yesistimu yomzamo owodwa ohlulekile, bese uqinisekisa ukuthi iyiphi isevisi ye-PAM elayishwa i-plugin nokuthi yiluphi ulayini we-module olusetshenziswa yileyo sevisi. Umlayezo ojwayelekile wokwehluleka kokuqinisekisa awuzihlukanisi, futhi nokuhlola ngesandla okuphumelelayo akwenzi, ngoba i-shell yakho ayiyona indawo yesevisi.

Ukubuka kwesistimu yamafayela kweyunithi yikhona okuvamile ukuba yicala lapho kuhluleka kuphela isevisi.

systemctl show -p ProtectHome -p ProtectSystem -p ReadWritePaths [email protected]
ls -l /var/lib/vpn-otp/*/.google_authenticator 2>/dev/null | head -n 20

Inketho A: khipha imfihlo ekhaya

Lapho isevisi ifihla i-/home futhi uthanda ukugcina leso sivikelo, gcina imfihlo endaweni engayibona. I-module yamukela indlela ye-secret= kanye ne-akhawunti ye-user= eyenza imisebenzi yamafayela, okuvumela isitoreji esimaphakathi ukuba sisebenzisele ubunikazi abaningi.

Lena iyinketho ecocekile, futhi iyona edinga ukuqapha okukhulu, ngoba isitoreji esabiwe senza isikhombisi esisodwa sibe umngcele wokuphepha wawo wonke ama-akhawunti.

auth required pam_google_authenticator.so secret=/var/lib/vpn-otp/${USER}/.google_authenticator user=vpn-otp

Hlola izinto ezintathu ngaphambi kokuthemba: i-akhawunti ikhona, inqubo yokusebenza ye-module ingashintsha iye kuyo, futhi amafayela ngeyayo ngamamodi avimbelayo. Ungasebenzisi i-~ noma indlela enokuguquguquka kwasekhaya kanye ne-user=, futhi ungacimi ukuhlolwa kobunikazi be-module ukuze indlela isebenze. Gcina isigaba sephasiwedi kanye nensalela yesiteki kungonakalisiwe.

Inketho B: shiya ifayela futhi uvule indlela

Uma imfihlo kufanele ihlale kusikhombisi sasekhaya somsebenzisi, iyunithi idinga ukubuka okuhlanganisa leso sikhombisi esisodwa ngaphandle kokudalula zonke izikhombisi zasekhaya kumhambisi. I-drop-in ingengeza i-bind mount enomkhawulo omncane ngaphansi kwekhaya eline-sandbox.

Lokhu kugcina ubunikazi ngomsebenzisi ngamunye njengemodeli, ngezindleko zokushintsha kweyunithi okufanele kubuyekezwe njalo lapho i-sandbox ishintsha.

Imikhawulo emibili ilula ukuiyeka. Indlela yokufunda kuphela efakwe ngaphansi kwesikhombisi esifihlwa yi-sandbox ayisidaluli, ngoba umzali akekho lapho. Futhi i-mount kufanele ibe nokubhala uma i-module kufanele ibuyekeze isimo, okuletha inketho elandelayo emdlalweni. Bhala i-drop-in njengefayela elihlukile esikhundleni sokuhlela iyunithi ephakishiwe ngaphansi kwe-/usr/lib, ukuze ukuthuthukiswa kwephakethe kungayihlanzi ngokuthula.

Inketho C: gcina i-sandbox futhi ulungise ukubhala kwesimo

Ukufunda imfihlo kuyingxenye eyodwa yokuqinisekisa. I-module ingabhala kabusha ulwazi lokuhlehla kwesikhathi, isivikelo sokudlala kabusha noma isibali, futhi ifayela elidlula ukuhlolwa kokufunda lingahluleka ekubhaleni.

Lokho kwehluleka kubonakala njengekhodi embi emzamweni olandelayo hhayi kulo, yingakho kudidaniswa nokuhlehla kwewashi.

Yinike isikhombisi sayo esibhalekayo futhi uqondise indlela yemfihlo lapho, esikhundleni sokwenza lonke ikhaya libhaleke. Qinisekisa umnikazi wesikhombisi, isikhala esikhululekile sesistimu yamafayela nokuthi iyunithi ikhawulela ukubhala kwenye indawo. Bese uhlola ukungena okubili okulandelanayo, ngoba okwesibili kufakazela indlela yokubhala kanti okokuqala kufakazela ukufunda kuphela.

Qinisekisa njengesevisi, hhayi njengawe

Konke ukuhlola okubalulekile kufanele kusebenze ngaphakathi kwe-sandbox yeyunithi ngobunikazi beyunithi.

Umyalo ophumelelayo njenge-root ukutshela ukuthi ifayela likhona futhi akukho okunye. Ukungena ngesevisi yangempela ukutshela ukuthi i-module ingayifunda imfihlo, iyisebenzise futhi ibhale emuva lokho ekudingayo.

Ekugcineni, gcina imfuneko ingonakalisiwe. Ukwengeza inketho yephasiwedi eyize, ukwamukela ukwehluleka kokufunda kuphela noma ukususa i-sandbox konke kunganciphisa uphawu ngokushintsha inqubomgomo. Umsebenzisi okudingeka abonise ikhodi kufanele asanqanyulwa lapho imfihlo ingafinyeleleki.